CVE-2026-100408: Git for Windows: git-credential-wincred Erase Path Heap Overflow
Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git: credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in matchcredpassword() and then uses wcsncpys() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Git for Windowsto a version that resolves this vulnerability.Fixed in 2.55.0.windows.3
Event History
Frequently Asked Questions
Which systems are affected?
Git for Windows versions from 2.43.0.windows.1 through 2.55.0.windows.3 are affected. The issue requires a matching git:* credential to already exist in Windows Credential Manager.
What is required to trigger the vulnerable path?
The git-credential-wincred erase operation must receive an input containing a password field. Erase requests without a password field do not enter the vulnerable password-comparison path.
What is the practical impact of the issue?
The helper can terminate with a Windows heap-corruption status due to a two-byte NUL write beyond the allocated buffer. A git credential reject operation may appear to succeed even though the rejected credential remains stored.
What should be done to remediate this issue?
Update Git for Windows to version 2.55.0.windows.3, which fixes the issue.